chaos

General

Target

2024-06-11_c4e33d7fd77461b59abd3c3fa3bb2581_destroyer_wannacry
Size

27KB
Sample

240611-le85yssapc
MD5

c4e33d7fd77461b59abd3c3fa3bb2581
SHA1

0664f4e2a19a83fb8116586efe5841b176a8ac1c
SHA256

13093afa52908c4ae621f363fa63a68d204b0c895815a94f2924b8d289b388d1
SHA512

33f574a12b4209f8d04e1ad8daa54ec0bf6d42e5ca0f3d259dcda7781b9955d4b5148fadc0d22dde83da727295834689d0ca388785e8cc03903793b5837c5d76
SSDEEP

384:MftWZPzzxAm1vp5ZRoDCFKW6pAnAQ51Ml4Oy5o91fDpC82vy:MW7zxAmpfyCz6pVQ53ho9hDo82a

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\read_it.txt

Ransom Note

Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Emails

[email protected]

Targets

- Target
  
  2024-06-11_c4e33d7fd77461b59abd3c3fa3bb2581_destroyer_wannacry
- Size
  
  27KB
- MD5
  
  c4e33d7fd77461b59abd3c3fa3bb2581
- SHA1
  
  0664f4e2a19a83fb8116586efe5841b176a8ac1c
- SHA256
  
  13093afa52908c4ae621f363fa63a68d204b0c895815a94f2924b8d289b388d1
- SHA512
  
  33f574a12b4209f8d04e1ad8daa54ec0bf6d42e5ca0f3d259dcda7781b9955d4b5148fadc0d22dde83da727295834689d0ca388785e8cc03903793b5837c5d76
- SSDEEP
  
  384:MftWZPzzxAm1vp5ZRoDCFKW6pAnAQ51Ml4Oy5o91fDpC82vy:MW7zxAmpfyCz6pVQ53ho9hDo82a
Score

10^/10

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2